CVE-2010-2252

GNU Wget 1.12 and earlier uses a server-provided filename instead of the
original URL to determine the destination filename of a download, which
allows remote servers to create or overwrite arbitrary files via a 3xx
redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a
URL with a crafted filename, and possibly execute arbitrary code as a
consequence of writing to a dotfile in a home directory.

Bugs

• <https://savannah.gnu.org/bugs/?29958&gt;
• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590296&gt;
• <https://bugzilla.redhat.com/show_bug.cgi?id=602797&gt;
• <https://bugzilla.redhat.com/show_bug.cgi?id=591580&gt;